Implement keep: self-hosted E2E encrypted secrets sync

Server: Express + better-sqlite3 (WAL), multi-recipient key-wrapping
per IMPLEMENTATION.md's design — vaults/recipients/vault_grants/
access_log. Two auth paths: ADMIN_PASSWORD header for recipient
management and revoke (pure metadata operations), signed-request
auth (Ed25519 signature over method+path+timestamp+body-hash) for
push/pull/grant, mirroring the spirit of this project family's other
signed-handshake patterns without naming them.

CLI: identity init/show/set-id, push/pull/grant/log, admin recipient
add/list/remove and revoke. Grant is a client-side crypto operation
(the granter unwraps the vault's current key locally and reseals it
for the new recipient) rather than a server-side operation, since the
server never holds an unwrapped key to grant with.

Verified end-to-end with two independent local identities against a
live server and separately against the built Docker image: register,
push, pull (granted and ungranted), grant without re-pushing, admin
revoke, a subsequent rotation confirming the revoked recipient stays
excluded, and rejection of missing/malformed signed-request auth.

Two real bugs caught during verification, not just written up:
- libsodium-wrappers' published ESM build does a relative import only
  resolvable under bundler-style resolution — broken under plain Node
  ESM. Fixed via createRequire to force the CJS build.
- Express's req.path inside a sub-router is relative to the mount
  point, which would have silently mismatched a client signing the
  full request path. Fixed by verifying against req.originalUrl.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/cli/commands/recipient.ts

@@ -0,0 +1,20 @@
+import { adminFetch, expectOk } from '../signedFetch.js';
+
+export async function recipientAdd(label: string, publicKey: string): Promise<void> {
+  const data = await expectOk(await adminFetch('POST', '/api/admin/recipients', { label, publicKey }));
+  console.log(`recipient created: ${data.recipientId}`);
+  console.log(`Give this id back to whoever owns this identity — they set it with 'keep identity set-id ${data.recipientId}'.`);
+}
+
+export async function recipientList(): Promise<void> {
+  const data = await expectOk(await adminFetch('GET', '/api/admin/recipients'));
+  if (!data.length) { console.log('no recipients yet.'); return; }
+  for (const r of data) {
+    console.log(`${r.recipientId}  ${r.label}  ${r.publicKey.slice(0, 16)}…`);
+  }
+}
+
+export async function recipientRemove(recipientId: string): Promise<void> {
+  await expectOk(await adminFetch('DELETE', `/api/admin/recipients/${encodeURIComponent(recipientId)}`));
+  console.log(`recipient removed: ${recipientId} (and all their vault grants)`);
+}